Leaflet Map < 3.0.0 - Arbitrary Settings Update via CSRF Leading to Stored XSS

The plugin does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the JavaScript library being used, or usin...

WordPress Leaflet Map plugin <= 2.23.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Leaflet Map plugin versions = 2.23.3. Solution Update the WordPress Leaflet Map plugin to the latest available version at least 3.0.0...

Malicious Package in leaflet-gpx

Version 1.0.1 of leaflet-gpx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluate yo...

GHSA-GJC9-932X-C59P Malicious Package in leaflet-gpx

Version 1.0.1 of leaflet-gpx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluate yo...

@here/harp-leaflet (>=0.2.4, <=0.2.5) potentially affected by CVE-2020-8244 via bl (4.0.2)

bl NPM version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on bl and may be impacted: - @here/harp-leaflet =0.2.4, =0.2.5 Source cves: CVE-2020-8244 Source advisory: OSV:GHSA-PP7H-53GX-MX7R...

Man-in-the-Middle (MitM)

com.liferay.map.openstreetmap is vulnerable to man-in-the-middle attacks. The bundle loads the npm package leaflet using HTTP instead of HTTPS. This allows an attacker to perform a man-in-the-middle attack to modify the package contents...

Malicious Package

Overview Version 1.0.1 of leaflet-gpx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and...

Typo3 CMS BrowserMaps Leaflet Tutorial tx_browser_pi1 8.0.39 SQL Injection

Exploit Title : Typo3 CMS BrowserMaps Leaflet Tutorial txbrowserpi1 8.0.39 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 18/02/2019 Vendor Homepage : typo3-organiser.de typo3.org Software Download Links :...

WordPress Leaflet Maps Marker Plugin <= 3.5.3 - SQL Injection

This plugin is prone to tag multiple parameter SQL injection. Solution Upgrade the plugin...

WordPress Leaflet Maps Marker Plugin <= 2.3 - Multipe Vulnerabilities

This plugin is prone to multiple security issues. Solution Update the plugin...

WordPress Leaflet Maps Marker Pro Plugin - Multiple Vulnerabilities

This plugin is prone to SQL injection, cross site scripting, shell upload and file deletion vulnerabilities. Solution Update the plugin...

Leaflet Maps Marker 3.5.2 - Two SQL Injection Vulnerabilities

The Leaflet Maps Marker Google Maps, OpenStreetMap, Bing Maps WordPress plugin was affected by a Two SQL Injection Vulnerabilities security vulnerability...

Leaflet Maps Marker Pro - SQLI, XSS, Shell Upload, file delete

The leaflet-maps-marker-pro WordPress plugin was affected by a SQLI, XSS, Shell Upload, file delete security vulnerability...

Leaflet Maps Marker - Multiple security issues

The mapsmarker WordPress plugin was affected by a Multiple security issues security vulnerability...

SA-CONTRIB-2014-005 - Leaflet - Access bypass

The Leaflet module enables you to display an interactive map using the Leaflet library, using entities as map features. The module exposes complete data from entities used as map features to any site visitor with a Javascript inspector like Firebug. CVE identifiers issued ACVE identifier will be...

Wordpress Plugins - leaflet maps marker Blind SQL Injection Vulnerability

Exploit for php platform in category web applications ================================================================================ || | | || || || |/ | || |/ | | | | | | | | | | | \ | | | | \ ================================================================================ Exploit Title:...

CVE-2012-2913

Multiple cross-site scripting XSS vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the id parameter to 1 leafletlayer.php or 2 leafletmarker.php, as reachable through wp-admin/admin.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the id parameter to 1 leafletlayer.php or 2 leafletmarker.php, as reachable through wp-admin/admin.php...

CVE-2012-2913

The CVE-2012-2913 entry concerns the Leaflet Maps Marker WordPress plugin (version 0.0.1) where unsanitized input in the id parameter (used by leaflet_layer.php and leaflet_marker.php via wp-admin/admin.php) enables cross-site scripting (XSS). Root cause: improper input handling in the id field l...

CVE-2012-2913

Multiple cross-site scripting XSS vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the id parameter to 1 leafletlayer.php or 2 leafletmarker.php, as reachable through wp-admin/admin.php...